services:
  herald:
    build:
      context: .
      dockerfile: docker/Dockerfile
    image: herald:local
    ports:
      # Main service port: host 8082 -> container 8082.
      - "127.0.0.1:8082:8082"
    environment:
      - PORT=:8082
      - ENVIRONMENT=production
      - REDIS_ADDR=redis:6379
      # Compose refuses to start until a Redis password is supplied via the
      # environment or a .env file. Never fall back to a repository-known secret.
      - REDIS_PASSWORD=${REDIS_PASSWORD:?set REDIS_PASSWORD}
      - REDIS_DB=0
      - LOG_LEVEL=info
      # The quick-start stack uses API-key mode and refuses repository-known
      # placeholder credentials. Production HMAC deployments should configure
      # Herald outside this minimal example.
      - REQUEST_AUTH_MODE=api_key
      - API_KEY=${HERALD_API_KEY:?set HERALD_API_KEY}
      - PROVIDER_FAILURE_POLICY=strict
    volumes:
      - audit_spool:/var/lib/herald/audit
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      # Hit the app's own liveness endpoint. Uses the shipped binary rather than
      # curl (which is intentionally not installed in the runtime image).
      test: ["CMD", "/bin/herald", "-healthcheck"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 10s
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  redis:
    image: redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf
    # Redis is NOT published to the host by default. Uncomment only if you must
    # reach it from outside the compose network, and protect it with a password.
    # ports:
    #   - "127.0.0.1:6379:6379"
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:?set REDIS_PASSWORD}"]
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:?set REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    volumes:
      - redis_data:/data
    restart: unless-stopped

volumes:
  redis_data:
  audit_spool: